aboutsummaryrefslogtreecommitdiff
path: root/net/irda
diff options
context:
space:
mode:
authorEric Dumazet <eric.dumazet@gmail.com>2010-08-18 00:24:43 +0000
committerDavid S. Miller <davem@davemloft.net>2010-08-19 00:41:52 -0700
commit79c5f51c639021f7472591239c3867cee4b9ec02 (patch)
treed7aeb85577fdb66ab2f4682778e135f263cadb6a /net/irda
parent9c38657cfcb739b7dc4ce9065a85b4f0c195bef8 (diff)
downloadvexpress-lsk-79c5f51c639021f7472591239c3867cee4b9ec02.tar.gz
irda: fix a race in irlan_eth_xmit()
After skb is queued, its illegal to dereference it. Cache skb->len into a temporary variable. Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/irda')
-rw-r--r--net/irda/irlan/irlan_eth.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/net/irda/irlan/irlan_eth.c b/net/irda/irlan/irlan_eth.c
index 9616c32d107..5bb8353105c 100644
--- a/net/irda/irlan/irlan_eth.c
+++ b/net/irda/irlan/irlan_eth.c
@@ -169,6 +169,7 @@ static netdev_tx_t irlan_eth_xmit(struct sk_buff *skb,
{
struct irlan_cb *self = netdev_priv(dev);
int ret;
+ unsigned int len;
/* skb headroom large enough to contain all IrDA-headers? */
if ((skb_headroom(skb) < self->max_header_size) || (skb_shared(skb))) {
@@ -188,6 +189,7 @@ static netdev_tx_t irlan_eth_xmit(struct sk_buff *skb,
dev->trans_start = jiffies;
+ len = skb->len;
/* Now queue the packet in the transport layer */
if (self->use_udata)
ret = irttp_udata_request(self->tsap_data, skb);
@@ -209,7 +211,7 @@ static netdev_tx_t irlan_eth_xmit(struct sk_buff *skb,
self->stats.tx_dropped++;
} else {
self->stats.tx_packets++;
- self->stats.tx_bytes += skb->len;
+ self->stats.tx_bytes += len;
}
return NETDEV_TX_OK;